Lucas WintherandClaude Opus 5.5
0da35ec6f8
The proxy, its internal server, Unix socket and NO_PROXY changes are gone; main.ts serves the HTML import directly again. apps/web/index.html carries the SPA policy as <meta http-equiv=CSP> ahead of every script (script-src 'self' plus the hash of Bun's dev-server helper, no unsafe-inline/eval; no frame-ancestors, which meta cannot carry). Dev HMR connects under it. The runner frame keeps its header CSP. Tests: the served index.html (prod and dev, in a subprocess) has the meta policy and every inline script is hash-covered; the XSS browser test fails with the sanitizer disabled and passes with it, and the meta CSP alone blocks unsanitized handlers (with a no-CSP control); no source assigns proxy env vars, and the feature leaves them untouched at runtime. Contract request 5 asks core for frame-ancestors/X-Frame-Options. Co-Authored-By: Claude Opus 5.5 <[email protected]>
STCourses
STCourses is a self-hosted course platform. Homelabbers, universities and companies host their own courses, plus material they already own such as Packt video packages or Pluralsight slide PDFs, in one place that tracks progress. Authors write in Markdown in a git repo or in a browser studio; both edit the same files. Each install has one owner and is not multi-tenant.
Development
bun install # install workspace dependencies
bun test # run all tests
bun run typecheck # tsc --noEmit
bun run dev # start the server with hot reload
License: AGPL-3.0-only.